0x12: Edoardo Mantovani - From Metal to WebUSB: Reimplementing a Wi-Fi 6 Driver...

### Overview This talk details the reverse engineering and reimplementation of a Wi-Fi 6 kernel driver in user space and directly within the web browser using WebUSB. Focusing on inexpensive AICsemi (referred to in the presentation as Semi / AICsemi) USB Wi-Fi dongles—specifically targeting the D80 chipset model over the more limited DC model—the speaker demonstrates how moving low-level hardware control out of the Linux kernel enables cross-platform usability, offensive wireless attacks, and runtime firmware reverse engineering and patching.

### Key Topics - **Target Hardware Architecture**: The landscape of USB Wi-Fi dongles (Realtek, MediaTek, and AICsemi), focusing on the AICsemi D80 model which operates over USB 2.0, supports Wi-Fi 6 (5 GHz band), and integrates Bluetooth 5.3/5.4. - **Driver and Boot Process**: Understanding how the dongle initially enumerates as a 3–4 MB USB mass storage device containing Windows drivers, requiring a SCSI command to switch into ROM mode. In ROM mode, an initial loader pushes the RAM firmware before the primary operational driver takes over. - **User-Space Driver Reimplementation**: Porting the out-of-tree Linux driver logic to a single user-space file using `libusb`, allowing the driver to function across both Linux and Windows without compiling kernel modules. - **WebUSB & WebAssembly Driver**: Migrating the user-space driver directly into Chromium-based browsers via WebUSB, combining a JavaScript state machine and UI with WebAssembly to execute low-level operations without host installation. - **Offensive Wireless Operations**: Enabling monitor mode and raw frame injection to execute deauthentication attacks against WPA2 and WPA3 networks, as well as launching evil twin attacks against captive portals. - **Browser-Based Firmware Patching**: Developing a framework leveraging WebAssembly builds of TinyCC (TCC with Thumb mode) and Ghidra's decompiler to read, decompile, patch, and execute arbitrary code in the dongle's ARM32 Thumb firmware at runtime.

### Technical Details - **Monitor Mode and Injection**: While public reports claimed the D80 model lacked functional monitor mode, reverse engineering revealed that the stock driver imposed overly strict receive filters. Supplying permissive filter flags enabled capturing raw frames, while frame injection functioned natively. - **Bypassing Protected Management Frames (PMF)**: To disrupt WPA2 and WPA3 connections protected by management frame protection, the driver sniffs the frame control field to detect early four-way handshake authentication exchanges and immediately fires deauthentication frames before PMF is established. - **Evil Twin with Captive Portal**: Using WebUSB, the driver jams legitimate target connections via deauthentication frames while transmitting fake beacons with matching SSIDs. When target clients connect to the beacon, the browser-driven stack serves custom HTML captive portals, verified against Android devices. - **Firmware Reverse Engineering and Patching**: The firmware runs on an ARM32 core in Thumb mode. By analyzing assert strings and leaked SDK source code sharing the MAC layer, the author mapped the transmit execution path. The firmware exposes commands to read and write arbitrary runtime memory. By overwriting the callback of an unused firmware command (`start NPC request`), custom C code compiled in-browser via TCC was injected into firmware memory to transmit raw 802.11 beacon frames directly from firmware transmit queues.

### Takeaways - Bypassing the kernel network stack with user space (`libusb`) and WebUSB drastically simplifies deploying custom wireless tools without requiring kernel compilation, admin privileges, or platform-specific driver builds. - Inexpensive commodity Wi-Fi dongles often run firmware with permissive debug capabilities—such as direct memory read/write commands—allowing deep runtime modification and weaponization without persistent flashing. - Web browsers (specifically Chromium engines supporting WebUSB and WebAssembly) provide a viable platform for performing offensive hardware interactions, packet crafting, fuzzing, and real-time firmware reverse engineering.